Threat Analyst, Coalition

• 2-4 years of experience in a cybersecurity operations or threat analysis role
• Hands-on experience with EDR platforms such as Microsoft Defender, SentinelOne, or CrowdStrike Falcon
• Familiarity with SIEM platforms (e.g., Microsoft Sentinel, Splunk) for log analysis and threat detection
• Basic understanding of incident response processes, including containment, eradication, and recovery
• Knowledge of malware analysis, network protocols, and system log analysis
• Strong analytical skills with attention to detail in identifying patterns and anomalies
• Ability to communicate effectively with technical and non-technical audiences

Desirable

• We are looking for a Threat Analyst to support and expand Coalition’s Managed Detection and Response (MDR) security program
• This role focuses on threat detection, analysis, and response within platforms like Microsoft Defender, SentinelOne, and CrowdStrike Falcon
• As part of the MDR team, you will play a crucial role in protecting our policyholders/enhancing Coalition’s cybersecurity capabilities
• You will work closely with a collaborative team of analysts, engineers, and security professionals to deliver cutting-edge detection and response solutions
• This role provides opportunities for growth, exposure to advanced threat analysis techniques, and hands-on experience with leading security tools
• The Threat Analyst role reports to the MDR Team Lead and partners with the IT and Security Engineering teams
• Monitor and analyze security alerts from EDR platforms (Microsoft Defender, SentinelOne, CrowdStrike Falcon)
• Investigate and respond to incidents, including identifying Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)
• Perform initial forensic analysis on logs, endpoints, and network data to assess potential threats
• Collaborate with senior analysts on the investigation and resolution of advanced threats
• Develop clear and concise incident reports for technical teams and business stakeholders
• Assist in maintaining and fine-tuning detection rules and security monitoring configurations
• Stay updated on emerging threats, vulnerabilities, and attack techniques
• Contribute to team documentation, playbooks, and processes to enhance operational efficiency